Ride the Lightning

A WRINKLE IN TIME: CHANGING THE CLOCK TO COVER YOUR TRACKS

November 14, 2007

An interesting case was reported recently on the Electronic Discovery Blog (http://www.electronicdiscoveryblog.com). In re Hawaiian Airlines involved something not very often seen in computer forensics – the changing of the computer clock. Spoliation, of course, is an everyday occurrence, and it happened here too. The defendant installed a scrubbing program (very ho-hum these days) to erase what one would assume to be incriminating data. The unusual part was that he changed the system clock to make it appear as though the data had been deleted prior to the filing of the complaint. Tsk, tsk. The evidence revealed that the defendant had begun looking for scrubbing software within a week of receiving a litigation hold e-mail from corporate counsel. He also signed a declaration swearing that he only copied the data at issue onto a CD and not to any of his computers. Confronted with evidence to the contrary, he went on his wiping mission. The result was an adverse inference instruction and the case continues on. As anyone involved in computer forensics knows, the granting of an adverse inference does not bode well for a defendant. The opinion in the case is posted at http://www.electronicdiscoveryblog.com/cases/hawaiian_airlines.pdf

E-mail:    Phone: 703-359-0700